CVE-2025-11941
BaseFortify
Publication date: 2025-10-19
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| e107 | e107_cms | 2.3.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11941 is a vulnerability in e107 CMS versions up to 2.3.3, specifically in the Avatar Handler component of the Media Manager. It allows an authenticated admin user to perform arbitrary file deletion on the server by exploiting improper validation of the 'multiaction[]' parameter in the file /e107_admin/image.php. The application attempts to filter out directory traversal sequences like '../', but this filter can be bypassed using patterns like '..././', enabling deletion of files outside the intended directory. This can be done remotely by manipulating POST requests to the avatar deletion endpoint. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary deletion of files on the server by an authenticated admin user, potentially causing data loss, denial of service, or further exploitation of the system. Since files outside the intended media directory can be deleted, critical system or application files might be removed, disrupting service availability and integrity. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring HTTP POST requests to the endpoint `/e107_admin/image.php?mode=main&action=avatar` that include the `multiaction[]` parameter with suspicious path traversal patterns such as `..././`. You can use network traffic inspection tools or web server logs to identify such requests. For example, using grep on web server logs: `grep 'e107_admin/image.php?mode=main&action=avatar' /var/log/apache2/access.log | grep multiaction`. Additionally, intercepting and inspecting POST requests with tools like Burp Suite or curl can help detect exploitation attempts. Checking for unexpected file deletions in the server file system, especially in directories outside the intended media folder, can also indicate exploitation. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the admin backend to trusted users only, monitoring and blocking suspicious POST requests containing path traversal patterns in the `multiaction[]` parameter, and applying strict input validation and canonicalization on file paths to prevent directory traversal. If possible, restrict file deletion operations to a whitelist of allowed files or directories and confine file operations strictly to a controlled media-only directory. Since no official patch or vendor response is available, consider replacing or upgrading the affected product to a secure alternative. Additionally, monitor server logs for signs of exploitation and maintain regular backups to recover from potential data loss. [1, 3, 2]